Notifications
Clear all
Topic starter
20/08/2026 5:49 pm
TL;DR: AI-generated and AI-assisted code now accounts for 42% of committed code, while Sonar says its users are 24% more likely to report lower vulnerability rates and 20% more likely to report lower defect rates, underscoring that verification has become the real bottleneck in modern software delivery, according to Sonar. The security shift is no longer about producing more code faster, but about embedding automated guardrails for human and agentic workflows before defects, secrets, and architectural drift reach production.
NHIMG editorial — based on content published by Sonar: SonarQube’s 2025 year in review
By the numbers:
- AI-generated or AI-assisted code now accounts for 42% of all committed code, according to Sonar.
- SonarQube analyzes over 750 billion lines of code daily for more than 7 million developers and 400,000 organizations.
- Sonar says its users are 24% more likely to report lower vulnerability rates.
Questions worth separating out
Q: How should security teams secure AI-assisted development without overwhelming AppSec workflows?
A: Start with continuous discovery, then connect findings to exposure, criticality, and data sensitivity before remediation begins.
Q: Why do AI coding agents create access and governance risk even when they are not autonomous?
A: Because they already operate with tool access, repository access, and execution permissions inside a live workflow.
Q: What breaks when secret scanning only covers public repositories?
A: Repository-scoped scanning misses secrets that leak through forks, issues, comments, build logs, open source contributions, and attacker-controlled exfiltration paths.
Practitioner guidance
- Embed verification at the point of creation Shift security checks into the IDE, pull request, and CI/CD stages so insecure code is blocked before merge, not after release.
- Govern agent access to remediation tools Treat AI coding agents as delegated non-human identities.
- Harden secrets prevention and revocation Scan for API keys, passwords, and tokens before commit, rotate exposed credentials immediately, and connect detection to revocation workflows so leaked secrets do not remain valid.
What's in the full article
Sonar’s full year-in-review post covers the operational detail this analysis intentionally leaves for the source:
- Specific product changes across AI Code Assurance, Advanced Security, and MCP Server integration for real-world deployment decisions
- Expanded support details for AI-native IDEs and agentic coding workflows, including where the controls sit in the development lifecycle
- Implementation context for secrets detection, architecture management, and SDLC governance inside SonarQube environments
- Release-specific milestones such as the 2025.1 LTA and compliance coverage additions for teams tracking platform maturity
👉 Read Sonar’s year-in-review analysis of AI code assurance, MCP, and advanced security →
AI code assurance and agentic analysis: are your controls keeping up?
Explore further
20/08/2026 6:29 pm
AI code generation has turned verification into the primary security bottleneck. The article’s core finding is not that teams need more code faster, but that they need stronger verification where code is produced and remediated. That is a meaningful shift for application security and identity governance alike, because the tooling layer now includes agents, IDEs, and workflow integrations that must be scoped and audited. Practitioners should treat AI-driven delivery as a governance problem, not only a developer productivity problem.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How should teams govern architecture drift when AI agents can change code continuously?
A: Teams should turn architectural intent into automated policy checks that run on every change, not periodic reviews. That lets them catch dependency violations, trust path expansion, and layering drift while the code is still moving, which is the only point where governance can keep pace with agentic delivery.
👉 Read our full editorial: AI code assurance is becoming the new verification layer
